<!DOCTYPE html
  PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
  "DTD/xhtml1-strict.dtd">
<html>
  <head>
    <title>volatility.plugins.filescan : API documentation</title>
    <meta content="text/html;charset=utf-8" http-equiv="Content-Type" />
    <link href="apidocs.css" type="text/css" rel="stylesheet" />
    
    
  </head>
  <body>
    <h1 class="module">v.p.filescan : module documentation</h1>
    <p>
      <span id="part">Part of <a href="volatility.html">volatility</a>.<a href="volatility.plugins.html">plugins</a></span>
      
      
    </p>
    <div>
      
    </div>
    <div>&#64;author:       Andreas Schuster
&#64;license:      GNU General Public License 2.0 or later
&#64;contact:      <a class="rst-reference external" href="mailto:a.schuster&#64;forensikblog.de" target="_top">a.schuster&#64;forensikblog.de</a>
&#64;organization: <a class="rst-reference external" href="http://computer.forensikblog.de/en/" target="_top">http://computer.forensikblog.de/en/</a><table class="fieldTable"></table></div>

    
    
    <div id="splitTables">
      <table class="children sortable" id="id953">
  
  
<tr class="class">
    
    
    <td>Class</td>
    <td><a href="volatility.plugins.filescan.PoolScanFile.html">PoolScanFile</a></td>
    <td><span>PoolScanner for File objects</span></td>
  </tr><tr class="class">
    
    
    <td>Class</td>
    <td><a href="volatility.plugins.filescan.FileScan.html">FileScan</a></td>
    <td><span>Scan Physical memory for _FILE_OBJECT pool allocations</span></td>
  </tr><tr class="class">
    
    
    <td>Class</td>
    <td><a href="volatility.plugins.filescan.PoolScanDriver.html">PoolScanDriver</a></td>
    <td><span>Scanner for _DRIVER_OBJECT</span></td>
  </tr><tr class="class">
    
    
    <td>Class</td>
    <td><a href="volatility.plugins.filescan.DriverScan.html">DriverScan</a></td>
    <td><span>Scan for driver objects _DRIVER_OBJECT</span></td>
  </tr><tr class="class">
    
    
    <td>Class</td>
    <td><a href="volatility.plugins.filescan.PoolScanSymlink.html">PoolScanSymlink</a></td>
    <td><span>Scanner for symbolic link objects</span></td>
  </tr><tr class="class">
    
    
    <td>Class</td>
    <td><a href="volatility.plugins.filescan.SymLinkScan.html">SymLinkScan</a></td>
    <td><span>Scan for symbolic link objects</span></td>
  </tr><tr class="class">
    
    
    <td>Class</td>
    <td><a href="volatility.plugins.filescan.PoolScanMutant.html">PoolScanMutant</a></td>
    <td><span>Scanner for Mutants _KMUTANT</span></td>
  </tr><tr class="class">
    
    
    <td>Class</td>
    <td><a href="volatility.plugins.filescan.MutantScan.html">MutantScan</a></td>
    <td><span>Scan for mutant objects _KMUTANT</span></td>
  </tr><tr class="class">
    
    
    <td>Class</td>
    <td><a href="volatility.plugins.filescan.CheckProcess.html">CheckProcess</a></td>
    <td><span>Check sanity of _EPROCESS</span></td>
  </tr><tr class="class">
    
    
    <td>Class</td>
    <td><a href="volatility.plugins.filescan.PoolScanProcess.html">PoolScanProcess</a></td>
    <td><span>PoolScanner for File objects</span></td>
  </tr><tr class="class">
    
    
    <td>Class</td>
    <td><a href="volatility.plugins.filescan.PSScan.html">PSScan</a></td>
    <td><span>Scan Physical memory for _EPROCESS pool allocations</span></td>
  </tr>
  
</table>
      
      
    </div>
    
    
    

    
    <address>
      <a href="index.html">API Documentation</a> for Volatility 2.2, generated by <a href="http://codespeak.net/~mwh/pydoctor/">pydoctor</a> at 2013-06-24 15:16:10.
    </address>
  </body>
</html>